Red Hat JBoss Enterprise Application Platform Expansion Pack.

Keycloak-services: keycloak-services: inactive out-of-audience token introspection leaks signed jwt claim

• Red Hat Build of Keycloak
• Red Hat Data Grid 8
• Broken access control

Keycloak-services: keycloak-services: missing per-role authorization on rolecontainerresource composite endpoints

• Red Hat build of Keycloak 26.6
• Red Hat build of Keycloak 26.6.7
• Broken access control

Keycloak-services: keycloak-services: microsoft external access-token exchange bypasses configured tenant

• Red Hat build of Keycloak 26.6
• Red Hat build of Keycloak 26.6.7
• Authentication bypass

Keycloak-services: keycloak-services: saml http-redirect binding response preserves query string leading to parameter pollution

• Red Hat Build of Keycloak
• Red Hat Data Grid 8
• CWE-20

Keycloak-services: keycloak-services: client not-before revocation ignored when realm not-before is older but nonzero

• Red Hat build of Keycloak 26.6
• Red Hat build of Keycloak 26.6.7
• Broken access control

Keycloak-services: keycloak-services: generic identity-provider creation can bind brokers to organizations without manage-organizations

• Red Hat build of Keycloak 26.6
• Red Hat build of Keycloak 26.6.7
• Broken access control

Keycloak-services: keycloak-services: client policy source-group condition bypass via duplicate group name matching

• Red Hat Build of Keycloak
• Red Hat Data Grid 8
• Broken access control

Keycloak-services: keycloak-services: information disclosure via role-users endpoint bypasses per-user view filter

• Red Hat build of Keycloak 26.6
• Red Hat build of Keycloak 26.6.7
• Broken access control

Keycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api

• Red Hat build of Keycloak 26.6
• Red Hat build of Keycloak 26.6.6
• Information disclosure

Keycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptcha secrets to view-only admins

• Red Hat build of Keycloak 26.6
• Red Hat build of Keycloak 26.6.7
• Hard-coded credentials
• CWE-212

Keycloak-services: keycloak-services: incomplete fix for ciba brute-force lockout bypass at token redemption

• Red Hat Build of Keycloak
• Red Hat Data Grid 8
• CWE-305
• CWE-841

Keycloak-services: keycloak-services: incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles

• Red Hat build of Keycloak 26.6
• Red Hat build of Keycloak 26.6.7
• Broken access control
• CWE-1220

Keycloak-services: keycloak-services: realm default-group reads disclose hidden groups under fgap v2

• Red Hat build of Keycloak 26.6
• Red Hat build of Keycloak 26.6.7
• Information disclosure
• CWE-1220

Keycloak-services: keycloak-services: required signed-jwt assertion policy can be bypassed with unsigned assertion headers

• Red Hat build of Keycloak 26.6
• Red Hat build of Keycloak 26.6.7
• CWE-807

Keycloak-services: keycloak-services: authorization codes can be retargeted to another client session

• Red Hat build of Keycloak 26.6
• Red Hat build of Keycloak 26.6.7
• Authentication bypass
• CWE-472

Keycloak-services: keycloak-services: organization invitation link exposure allows unauthorized member creation

• Red Hat build of Keycloak 26.6
• Red Hat build of Keycloak 26.6.7
• Broken access control
• Information disclosure

Keycloak-services: keycloak-services: oidc idp update reuses masked client secret after token url change

• Red Hat Build of Keycloak
• Red Hat Data Grid 8
• CWE-1288

Keycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v2

• Red Hat build of Keycloak 26.6
• Red Hat build of Keycloak 26.6.7
• Broken access control

Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users

• Keycloak
• Red Hat JBoss Enterprise Application Platform 8
• Broken access control

Keycloak-services: keycloak-services: oidc email_verified claim incorrectly applied to userinfo email

• Red Hat Build of Keycloak
• Red Hat Data Grid 8
• CWE-1288

Keycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientresource

• Red Hat build of Keycloak 26.4
• Red Hat build of Keycloak 26.4.14
• Broken access control

Keycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permission

• Red Hat build of Keycloak 26.6
• Red Hat build of Keycloak 26.6.6
• Broken access control
• CWE-1220

Keycloak-admin-ui: keycloak-admin-ui:admin ui extension brute-force-user endpoint bypasses fgapv2 user view restrictions

• Red Hat build of Keycloak 26.4
• Red Hat build of Keycloak 26.4.14
• Broken access control

Networkmanager: networkmanager: local privilege escalation via malformed mud urls in dhclient backend

• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
• Command injection

Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak

• Red Hat build of Keycloak 26.4
• Red Hat build of Keycloak 26.4.12
• Server-side request forgery (SSRF)

Org.jboss.eap:wildfly-ejb3: improper deserialization in jboss marshalling allows remote code execution

• Red Hat JBoss Enterprise Application Platform 7
• Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
• Insecure deserialization

Wildfly: wildfly vulnerable to cross-site scripting (xss)

• Red Hat JBoss Enterprise Application Platform 7
• Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
• Cross-site scripting (XSS)

Eap-galleon: custom provisioning creates unsecured http-invoker

• Red Hat EAP 7.4.14
• Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
• CWE-665

Jboss-eap: aws-ec2: jboss eap and aws ec2: information disclosure via incorrect directory permissions

• Red Hat JBoss Enterprise Application Platform 5 for RHEL 6
• Red Hat JBoss Enterprise Application Platform 7
• Broken access control